Financial marketing now runs on more creative than any single review desk was built for. Several agencies produce it, media teams test it in dozens of variants, and creators post it to audiences the brand never sees. The approval queue hasn't kept pace.
A 2026 Cornerstone Advisors study, commissioned by Persado, found compliance review takes four to six weeks at some banks and credit unions, while 63% of their marketing teams already use generative AI to write content.
This guide covers financial services marketing compliance as a working system: the rules, a claims-and-approval workflow your agencies can follow, and the numbers that show whether it's working.
P.S. If you'd rather run this with one partner, our integrated marketing services build compliance into the brief from day one.
TL;DR
Our View: Approved claims are the raw material of financial creative. When agencies build from them, review becomes a fast check on execution, and media can test more variants because every part already passed. Creative, media and compliance work best side by side.
Financial services marketing compliance is the set of rules, reviews, and records that keep every financial ad, post, email, and page accurate, balanced, and provable. It covers what you say, who approves it, and what you keep as evidence.
The unit that matters most is the claim. A claim is any statement a regulator could ask you to prove: a rate, a fee, a return, an award, "no hidden fees," "conflict-free advice." Most enforcement actions trace back to a claim that was untrue, unsupported, or missing a disclosure.
Compliance is narrower than marketing risk management, which tracks brand, media, and data risks in a campaign risk register. Compliance is the part with a regulator on the other end.
Four rule sets cover most financial marketing: securities rules, banking and lending rules, UK financial promotion rules, and endorsement rules for creators. Many firms answer to more than one.
| Rule set | Who it covers | What it requires of marketing | What it means for the workflow |
|---|---|---|---|
| FINRA Rule 2210 | Broker-dealers | Fair, balanced communications; principal approval before use | Every retail ad needs a named approver and a dated record |
| SEC Marketing Rule 206(4)-1 | Registered investment advisers | No untrue or unsubstantiated claims; rules for testimonials, ratings, performance | Every claim needs proof on file before it runs |
| UDAAP, TILA (Reg Z), TISA (Reg DD), FDIC rules | Banks, lenders, credit unions, fintech partners | No deceptive or abusive claims; set disclosures when rates or terms appear | Rate and fee claims carry fixed disclosure text |
| FCA financial promotions rules and FG24/1 | UK-authorised firms and their affiliates | Fair, clear and not misleading; each social post must stand alone | Every creator post is reviewed as a full promotion |
| FTC Endorsement Guides | Any US brand paying creators | Clear disclosure of material connections | Creator contracts must include disclosure and monitoring |
Treat this as an operating guide and check legal questions with counsel. Your compliance and legal teams decide how each rule applies to your products.
Under FINRA Rule 2210, any written communication that reaches more than 25 retail investors in 30 days is a retail communication.
A qualified registered principal must approve each one before it's used or filed with FINRA, and content can't be false, exaggerated, promissory, or misleading.
Investment advisers follow the SEC Marketing Rule. It bans untrue statements and material claims the adviser can't substantiate, and it sets conditions for testimonials, endorsements, and third-party ratings.
Paid promoters need a written agreement unless they're affiliates or earn $1,000 or less over 12 months, per the SEC's compliance guide.
Banks and lenders work under the CFPB's ban on unfair, deceptive, or abusive practices, plus product-specific advertising rules.
Regulation Z requires credit ads to state rates as an APR, and "trigger terms" such as "only 5% down" force extra disclosures.
Regulation DD sets similar rules for deposit ads, which must state rates as an annual percentage yield (APY), and FDIC rules govern the official advertising statement and how deposit insurance is described.
UK promotions must be fair, clear and not misleading, and the Consumer Duty raises the bar on consumer understanding.
The FCA's finalized social media guidance (FG24/1), published in March 2024, says each social post must be compliant on its own and that firms are responsible for how their affiliates and influencers promote them.
Enforcement has followed. The FCA had 19,766 promotions amended or withdrawn in 2024, up 97.5% from 10,008 in 2023.
The FTC revised its Endorsement Guides in 2023. Brands that pay creators are expected to tell them how to disclose, monitor what they post, and correct problems. The FTC's endorsement FAQs confirm that "#ad" and "Paid ad" remain acceptable labels.
Email and text campaigns carry their own rules on top of the content standards above.
Under the CAN-SPAM Act, every marketing email needs a valid postal address and a working opt-out honored within 10 business days, and the FTC can hold both the brand and the company that sends the email responsible.
That covers an agency sending on the brand's behalf. Marketing texts and autodialed calls generally need the consumer's prior express written consent under the TCPA.
Non-compliant financial marketing leads to fines, censures, cease-and-desist orders and forced corrections, plus the cost of finding and replacing every asset that carried the problem claim. Regulators also tend to work in sweeps, so one finding turns into a review of everything similar.
The SEC's Marketing Rule sweeps show how that plays out. In September 2024, it charged nine advisers with $1.24 million in combined penalties for untrue or unsubstantiated statements, and for testimonials, endorsements and ratings without required disclosures.
One firm advertised membership in an organization it didn't belong to. Another used a rating that was more than 20 years old.
Earlier rounds focused on hypothetical performance: five advisers settled in April 2024, paying $200,000 combined, after nine advisers settled in September 2023. In each round, firms were censured, ordered to cease and desist, and fined.
The FCA's route is amendment or withdrawal (covered in the UK section above), and FINRA's finfluencer fine is covered in the creator section below.
The cost that rarely makes headlines is rework: every pulled asset has to be found, replaced, and approved again. Step 8 of the workflow below exists for exactly that.
It fails at the handoffs. Each agency writes its own version of the claims, sends work through its own channel, and keeps its own records, so no one has the full picture.
The claims in those SEC cases didn't need a creative agency to go wrong. Add three agencies, each rewording the same claims for its own channel, and the odds rise. Localizing a campaign multiplies it again, since each market version is a new set of claims.
| Failure point | What it looks like | Rule it puts at risk |
|---|---|---|
| Claim drift | One agency turns "no monthly fee" into "totally free" | FINRA 2210 content standards, UDAAP |
| Variant volume | 40 versions ship, three were reviewed | Principal approval of each retail communication |
| Parallel intake | Three inboxes, three sets of conflicting comments | Supervision duties (FINRA Rule 3110) |
| Creator posting | A creator posts before sign-off | FINRA 2210 pre-approval, FCA FG24/1 |
| Scattered records | Approvals live in email threads and chat | FINRA 2210 recordkeeping, SEC books and records |
To size the problem, pull every live asset from the last quarter and list which agency made it and which claims it uses. Any claim worded two different ways is drift.
Build it in eight steps, in this order: claims first, briefs second, review third, records throughout. Each step has one owner and one output.
Step 2 is the one most teams skip, and it's where most review time goes. When agencies write claims themselves, compliance ends up approving new claims at the speed of ad production.
When agencies only assemble approved claims, review becomes a check on context and execution.
The process fits into how enterprise marketing operations already run intake and routing. Rolling it out across agencies is an operating-model change, so plan it like one with marketing change management.
If your agencies can't brief from a claims library today, our creative team builds concepts and production around approved claims from the first draft.
A claims library holds six fields per claim: approved wording, proof, required disclosures, approved channels, an expiry date, and banned rewordings. Each field answers a question an examiner or agency will ask.
Give each claim a short ID and its exact approved wording. Add an approved short version for formats with no room, such as a six-second video or a 30-character headline, so agencies don't improvise one.
Link the document or dataset that proves the claim, and name the person who owns it. This is the field that would have stopped several of the SEC's 2024 cases, where advisers described their advice as conflict-free without evidence to back it up.
Store the exact disclosure text plus where it goes: same screen, same size, spoken and on screen. The SEC's December 2025 risk alert found disclosures hidden in hyperlinks or set in smaller, lighter type than the testimonial, and treated them as not clear and prominent.
List where the claim may run. A performance figure that needs a paragraph of context belongs on a web page and doesn't fit a story ad. The FCA's rule that each social post must stand alone makes this field essential for UK firms.
Set a date and an event that forces review: the next fee-schedule change, rate reset, or award edition. Ratings need dates by rule, and a rating with no expiry is how a 20-year-old one ends up in an ad.
List the rewordings agencies must never use. This field does more than any other to stop drift, because it catches the "close enough" versions before they're written.
| Claim ID | Approved wording | Substantiation | Required disclosure | Channels | Expires | Prohibited variations |
|---|---|---|---|---|---|---|
| C-014 | "No monthly maintenance fee on Everyday Checking" | Fee schedule v12, owner: Product | "Other fees may apply. See fee schedule." Same screen, same size | Paid social, display, email, web | Next fee-schedule change | "Free checking," "no fees" |
| C-022 | "Rated a top advisory firm by [publisher], 2026" | Award letter, owner: Comms | Date of rating, period covered, whether a fee was paid | Web, email, print | Next edition of the award | "Best advisory firm," undated versions |
A library only works if one person owns it and agencies can search it. Treat it like any other piece of shared marketing knowledge, with an owner, a review date, and access for every agency team.
Three risk tiers cover most financial marketing: low for approved claims reused word for word, medium for new executions of approved claims, and high for anything with a new claim, rate, performance figure, or creator. The tier decides who reviews and how fast.
| Tier | Typical assets | Reviewers | Target turnaround | Pre-approval needed? |
|---|---|---|---|---|
| Low | Resized banner, approved claim and disclosure unchanged | Compliance approver, quick check | 1 business day | Yes for broker-dealer retail communications |
| Medium | New concept or script built from approved claims | Compliance approver, brand | 2 to 3 business days | Yes |
| High | New claim, rate, performance, testimonial, creator content, new product | Compliance approver, legal, filing where required | 5 to 10 business days | Yes, plus filing for some products |
The turnaround targets are ours, set for teams running the workflow above. Agree your own with compliance and publish them so agencies can plan production around them.
Low risk doesn't mean no approval for broker-dealers. FINRA Rule 2210 still requires principal approval of each retail communication, so the low tier is about speed. The rule lets firms supervise two kinds of content like correspondence: posts in interactive forums and communications that don't recommend or promote a product.
High-tier assets sometimes carry filing deadlines. New FINRA members must file retail communications 10 business days before first use during their first year. Ads promoting a specific registered fund must be filed within 10 business days of first use.
The brand's intake owner routes everything; agencies produce and submit; the compliance approver signs off; and legal reviews only what compliance escalates. Write it down as a responsibility matrix every agency signs.
| Activity | Brand marketing lead | Intake owner (marketing ops) | Agency teams | Compliance approver | Legal |
|---|---|---|---|---|---|
| Maintain the claims library | R | R | I | A | C |
| Write briefs | A | C | C | I | |
| Produce assets and variants | A | I | R | ||
| Submit the packet | I | A | R | ||
| Review and approve | C | R | I | A | C |
| Publish and traffic | I | A | R | I | |
| Retire expired claims | I | R | R | A |
The matrix rests on step 4's single intake, which keeps one queue and one record, plus one more rule.
Every agency, including creator managers, works from the same written procedures. FINRA's finfluencer case found the firm had no written procedures for supervising creator posts, which is the gap a signed matrix closes.
If your roster has grown to the point where nobody can draw this matrix, an agency roster consolidation checklist is a sensible first step.
A complete packet has eight items, and the intake owner should return any packet missing one before review starts:
Pro Tip: Put a packet checklist inside the agency's upload form. A missing field blocks the upload, so incomplete packets never reach the queue.
Approve the building blocks and the rules for combining them, then sample what gets produced. That cuts review time on performance creative without loosening the standard.
Approve headlines, claims, disclosures, and visuals as separate components, plus written rules for which can be combined. Agree in writing with your compliance approver which components may swap after approval. For broker-dealers, each retail communication still needs principal approval, so this makes approval faster without removing it.
Build ad templates with the disclosure as a locked layer that agencies and dynamic creative tools can't resize, move, or rewrite. A common failure is a resize that pushes the disclosure off screen or shrinks it below a readable size.
Review every AI-generated asset in the high tier and a fixed sample in the low tier. FINRA's 2026 oversight report treats its rules as technology-neutral, so content a model writes faces the same standards as content a person writes.
Our take on AI creative's limits covers where it still needs a human.
Modular approval also changes how you test. With approved parts, you can run structured creative tests on angle and format without sending each new variant back through full review.
Treat every paid creator post as your own ad: approve it before it goes live, disclose the relationship, and keep a copy. Regulators already do.
FINRA's first finfluencer case made this concrete. M1 Finance paid an $850,000 fine after more than 1,700 influencers promoted it between 2020 and 2023 with posts it hadn't approved in advance or kept.
In the UK, the FCA interviewed 20 finfluencers under caution in 2024.
A finfluencer contract should require pre-approval, disclosure, a 24-hour takedown duty, and access to archives.
For investment advisers, a paid creator above the SEC Marketing Rule's de minimis threshold (see the SEC section above) also needs a written agreement.
Run these two gates:
Require the disclosure on screen and spoken in the video, at the start, in plain words such as "Paid ad." A tag buried among ten other hashtags is easy to miss, and the FTC expects disclosures people will actually notice.
Archive every approved post as published, plus the creator's replies to comments about your product.
FINRA's 2026 report flagged firms that didn't pre-approve static creator content, supervise interactive content, or archive posts.
Creator programs at scale need dedicated roles for this. We've run creator activations in regulated categories, including a ketamine therapy brand (a regulated category), and the approval gates above are what keep those programs running.
You need an approval record for every asset, kept for the period your regulator sets, and software that lets every agency submit into one place. The record is what you show an examiner.
For broker-dealers, FINRA Rule 2210 lists what the record must hold:
FINRA ties retention to SEA Rule 17a-4, generally three years for communications. Investment advisers keep advertising records for five years under the Advisers Act books-and-records rule.
Missing records are a charge on their own: two of the nine advisers in the SEC's 2023 sweep hadn't kept copies of their ads.
| Software criterion | Why it matters with several agencies |
|---|---|
| Guest access with permissions | Each agency submits and sees only its own work |
| Version comparison | Reviewers see exactly what changed between rounds |
| Claim tagging | Every asset links to the claim IDs it uses |
| Tamper-proof archive | Records meet SEA Rule 17a-4 format rules |
| AI pre-screening | Flags missing disclosures before human review |
| Integrations | Locked files flow to ad platforms and the DAM |
Names that show up on most shortlists include Red Oak, Saifr, Smarsh, Ziflow and Kadince. Test each against the table with two of your agencies submitting real work.
Track six numbers monthly: cycle time, first-pass approval rate, rounds per asset, incomplete-packet rate, claims-library reuse rate, and corrections after publishing.
| Metric | How to calculate it | What it tells you | Healthy direction |
|---|---|---|---|
| Cycle time | Days from packet received to approval | Whether the queue keeps up with production | Down |
| First-pass approval rate | Assets approved in round one / all assets | Whether agencies brief from the library | Up |
| Rounds per asset | Total review rounds/assets approved | How much rework the process creates | Down |
| Incomplete-packet rate | Packets returned at intake/packets received | Whether agencies know what to send | Down |
| Claims-library reuse rate | Assets using only library claims / all assets | How much new-claim work reaches compliance | Up |
| Corrections after publishing | Live assets pulled or edited / assets published | Whether review catches what matters | Down |
Cycle time carries a direct media cost. Cornerstone's four-to-six-week figure means a new concept can reach market after the ads it was meant to replace have already worn out.
Put a number on it: daily spend on fatiguing ads, times the days a replacement sits in review, is the budget at risk.
Split the numbers by agency. A low first-pass rate from one agency usually points to briefing or training, and it's fixable.
Our measurement team builds this kind of reporting into the same dashboards as campaign results.
An agency partner is compliance-ready when it can answer four questions clearly before you sign, and a vague answer to any of them is a red flag.
| Question to ask | Strong answer | Red flag |
|---|---|---|
| How do you handle a claim that's not in our library? | We file a claim request before writing copy | We write it and let compliance catch it |
| Who submits work for review? | One named person, through your intake | Each creative emails reviewers directly |
| How do you manage creator approvals and archives? | Pre-approval and archiving are in every creator contract | Creators post on their own schedule |
| What happens to an asset changed after approval? | It's a new version and goes back to review | Small tweaks don't need another review |
Since the brand keeps the regulatory liability, put access to approval records and archives in the contract itself, along with the other data access terms in an agency contract.
One agency partner makes financial services marketing compliance easier because there's one claims library, one intake, one set of comments and one approval record. Every handoff between agencies is a place where a claim can drift, and a single partner removes most of them.
We've covered the trade-offs in detail in how an integrated agency compares with multiple vendors.
Fieldtrip is best for that integrated, compliance-friendly model. Strategy, creative, media, and measurement teams work from one shared plan, so compliance starts in the creative brief and carries through to execution.
Claims are approved before concepts are written, creators are briefed from the same library, and media teams only receive locked files. The result is fewer rounds of edits, fewer rejections, and no expensive mistakes from a claim nobody approved.
Schedule a meeting with the Fieldtrip team to review your current process, and we'll map where claims enter it and where cycle time goes.
Usually, yes. If the firm paid for the post or helped prepare it, FINRA treats it as the firm's own communication, and a new caption or edit makes it a new version. Route reposts through the low tier so approval stays fast.
Partly. Approving a claim fixes the wording, proof, and disclosure, but context can change meaning, so each asset still needs a check. The approved-channels field in the claims library limits where reuse is safe.
Before using a rating, the SEC Marketing Rule requires a reasonable basis to believe any survey behind it made favorable and unfavorable answers equally easy and wasn't designed to produce a set result. The ad must also disclose the rating's date and period, who gave it, and whether the firm paid for it.
The firm. Regulators hold the brand responsible for agencies and creators acting on its behalf. Contracts can assign takedown duties and costs to the agency, but they can't move the regulatory liability.
Approval comes first, since FINRA requires principal approval before filing. Record the filing date and type in the approval record, and add filing lead time to high-tier turnaround targets.
Yes. A paid creator who endorses an adviser is a promoter, so the post needs clear and prominent disclosure of payment and conflicts, and a written agreement once pay passes the de minimis threshold covered in the SEC section. The same December 2025 risk alert found advisers counting payments one at a time to stay under that threshold.
%2520(1).png)